Anti-Bot Vendors in 2026: Who Protects the Sites You Test and Automate

Cloudflare sits in front of 28.1% of all websites, according to W3Techs (October 2026). For the specialist bot-management vendors — DataDome, Akamai, HUMAN, Imperva, Kasada — there is no comparable public number at all.

Public trackers can tell you who sits in front of a site. They can't tell you how that splits across the commercial bot-management products, and practitioner chatter fills the gap with guesses: "DataDome is everywhere now," or "it's all Akamai." Neither rests on a published count.

What the public data does support is narrower: Cloudflare's proxy is everywhere, the specialists can't be counted from the outside, and a site can run two vendors stacked on top of each other.

That's still useful. If you already know what signals each vendor actually weights, this is the other half of the picture: not how they detect, but who they are and how to recognise them when you test, monitor or automate your own workflows.

What "anti-bot vendor market share" even means here

Nobody publishes this data.

No bot-management vendor discloses how many sites run its product in a form you can audit, and the analyst firms covering the category (Forrester's bot management research, Gartner's WAAP coverage) rank vendors by capability, not by footprint. An industry that sells seeing what nobody else can see is one of the least measurable corners of infrastructure. So this post gives a figure only where a public source states it, with the source and date next to it, and describes everything else qualitatively.

The public sources, and what each can and can't see:

1. W3Techs — tracks reverse proxy and CDN usage across a large sample of websites. It's the source for Cloudflare's share, because Cloudflare shows up in the proxy layer whether or not the site bought bot management.
2. BuiltWith and Wappalyzer — technology detection by script host, cookie name, and header signature. Good for challenge widgets and script-injected vendors. Weaker for edge-only products that leave no client-side trace until you trip them.
3. HTTP Archive's Web Almanac — the annual crawl-based dataset. Slow to update, but the closest thing to a neutral census the web has.
4. Vendor press and investor material — customer logos and corporate changes: HUMAN and PerimeterX announced their merger in July 2022, and Thales completed its acquisition of Imperva in December 2023.

Two caveats before the numbers:

Detection undercounts edge-only products. A site can run Akamai Bot Manager and look clean from the outside until you send it a request it doesn't like. Client-side trackers can't see it.

CDN presence is not a bot-management purchase. The single biggest error in every "Cloudflare owns bot detection" take. More below.

What the public numbers show

W3Techs' reverse-proxy survey is the one public dataset that covers several of these vendors at once. As of October 2026 (W3Techs, reverse proxy services):

• Cloudflare: used by 28.1% of all websites, which is 86.0% of the sites whose reverse proxy W3Techs can identify. Among top-10,000 sites with an identifiable reverse proxy, the figure is 65.8% (W3Techs, Cloudflare by site ranking).
• Akamai: 0.6% of all websites.
• Imperva: 0.1% of all websites.
• No monitored reverse proxy at all: 67.3% of websites.

These are proxy figures, not bot-management figures. They count Akamai's and Imperva's delivery networks, not whether Bot Manager or Imperva's bot protection is switched on. DataDome, HUMAN, Kasada, reCAPTCHA and hCaptcha aren't reverse proxies, so they don't appear in this survey at all.

The vendors, and how to tell which one a site runs

The reCAPTCHA, hCaptcha and Turnstile rows aren't the same product category as the rows around them — they're widgets a page embeds, not full bot-management systems — but you'll meet them on the same pages, so leaving them out would misrepresent what you actually hit.

Insight 1: Cloudflare's footprint isn't Cloudflare's bot-management footprint

Here's the deal. Cloudflare fronts 28.1% of all websites (W3Techs, October 2026). Some version of that number gets quoted constantly, and it's right for the proxy layer.

It is badly wrong as a bot-management number.

Full Bot Management — the ML scoring, the per-request bot score you can write firewall rules against, the TLS fingerprints — is a paid Enterprise add-on (Cloudflare docs, October 2026). Free-plan sites get Bot Fight Mode; Pro and Business get Super Bot Fight Mode (Cloudflare docs). Add basic rate limiting, and Turnstile if the operator bothered to add it. That's a real filter against crude bots. It is not the system a large retailer on an Enterprise contract is running.

Cloudflare doesn't publish how many of those sites have the add-on, so there's no public way to turn 28.1% into a bot-management share. What's certain is that the two numbers are different, and the second is smaller.

The proxy stat keeps getting recycled as a bot-detection stat. This is the most useful point here. If you skim the rest, keep this one.

Insight 2: the specialists are bought differently, so your sector won't look like the web

Web-wide share is the wrong denominator for a team anyway. You don't test "the web." You work with a handful of sites in one vertical, over and over.

The vendors reach sites through different buying routes, which is why the mix in one sector can look nothing like the web as a whole:

• Akamai and Imperva attach bot protection to an existing delivery or security contract, so they turn up where a company already buys its CDN or WAF from them.
• DataDome and Kasada sell bot protection on its own and plug into whatever CDN or server a site already runs.
• HUMAN sells bot defence alongside fraud and account-abuse protection.
• Cloudflare's self-serve plans include Bot Fight Mode or Super Bot Fight Mode, so a site gets some bot filtering without buying a bot product at all.

So the honest answer to "which vendor will I meet" is: go look at your own sites. A web-wide figure tells you what the industry looks like. It tells you almost nothing about your Tuesday.

Insight 3: stacking happens, and it changes what you test

A site can run two detection layers. Cloudflare at the edge plus DataDome in the application. Akamai plus hCaptcha on login. Imperva plus reCAPTCHA on checkout.

Stacking is usually deliberate, because the layers catch different things: the edge filters on network signals, including the TLS handshake, before any JavaScript runs, and the application layer scores behavior after.

The practical consequence for teams testing their own sites: the two layers can treat the same visit differently, so a test that only exercises the page can miss a rule that fires at the edge. If you own the site, test both layers, and allow-list your test traffic rather than letting your own checks trip your protection.

(This is also why a single fingerprint test page tells you little about a real site. Any one page examines one layer; our checker comparison explains what each one looks at.)

Insight 4: the challenge layer went free, and that moved the floor

Turnstile going free is arguably the most consequential change at the cheap end of this category — more than any enterprise product launch. When Turnstile became generally available in September 2023, Cloudflare made its Managed mode "completely free to everyone for unlimited use", and said more than 76,000 users had signed up by then.

Before, a small site that wanted a challenge on its forms had reCAPTCHA or hCaptcha to choose from. Turnstile added a free, drop-in alternative that Cloudflare pitches as privacy-preserving, and it works on sites that don't use Cloudflare's proxy.

That doesn't threaten DataDome or Akamai — different buyer, different problem. But the floor moved. A site with no detection at all can now add a challenge for free, and "something" stops crude bots. The easy sites got harder for spam scripts while the hard ones stayed about the same.

Insight 5: TLS fingerprinting happens before the page loads

Edge-layer products can analyse the TLS handshake, and they do it before a single byte of the page's JavaScript executes. Cloudflare, for example, gives Bot Management customers JA3 and JA4 fingerprints, which "identify TLS clients based on how they initiate connections" (Cloudflare docs). The challenge widgets in the table don't; they work in the page.

The handshake is negotiated by whatever client binary is actually running, underneath canvas, WebGL, fonts and everything else a page script can read. That matters for QA: a test that uses a plain HTTP library instead of a browser presents a different handshake from your visitors' browsers, so it can be treated differently at the edge and report results your real users never see. Test protected pages with a real browser. Our JA4+ fingerprint breakdown covers which fields get hashed.

ClickzProtect's explainer on browser and TLS fingerprinting covers the same layer from the defender's side.

What to do with this

Fingerprint the sites you are authorised to work with before you build. One curl with -I, one look at the cookie jar, five minutes. Facing Akamai rather than DataDome changes what you budget for and which terms you need to read.

Read the terms before the tech. A site that pays for DataDome on its ticketing pages is telling you it doesn't want automated traffic there, and its terms often say so outright. Where you need data from a protected site, ask for an API or for your traffic to be allow-listed rather than working around the protection.

Assume stacking. On your own site, test the real pages, not only a checker page, because the edge layer never shows up in a checker.

Check the proxy before you blame the page. If a geo test runs through a proxy whose addresses are already on threat feeds, the site may challenge it in ways real visitors never see, and your test measures the proxy rather than the page. On your own site, allow-list your test addresses. For the defender's side of the numbers, see ClickzProtect's bot detection statistics.

The contrarian read

The consensus view is that protection deepens every year: vendors improve every quarter and budgets grow. The public numbers can't confirm that, and the way the products are sold points somewhere else.

Our read is that the category is broadening rather than deepening. Free tiers like Turnstile and Bot Fight Mode put basic protection within reach of any site, which is real progress against crude scripts. Multi-layer, behaviorally-scored protection is still an enterprise purchase: it's expensive, its false positives cost revenue, and for many sites a challenge widget looks like enough. No public dataset measures that split, so treat this as an argument, not a finding.

For site owners, that's the useful point: a widget on its own is shallow protection, and if bots are a real cost to you, the layer you're missing is probably the one behind it.

Prediction for 2027: consolidation. Kasada and the smaller specialists get acquired by CDN or WAAP vendors, because standalone bot management is hard to run at scale when the CDNs bundle a decent version for free.

Frequently Asked Questions

Which anti-bot vendor is in front of the most websites in 2026?

Cloudflare, by a wide margin. W3Techs reports that 28.1% of all websites use Cloudflare as a reverse proxy, which is 86.0% of the sites whose reverse proxy it can identify (W3Techs, October 2026). No other vendor in this category comes close on that measure. The caveat: that is proxy share, not Bot Management share. Cloudflare's full Bot Management is a paid Enterprise add-on, and a site behind Cloudflare's proxy has not necessarily bought it.

Is there a public figure for how many websites use bot management software?

No. None of the bot-management vendors publishes a count of the sites running its bot product. The closest public data is W3Techs' reverse-proxy survey, which measures CDN and proxy use, not bot-management purchases: a Cloudflare or Akamai proxy in front of a site doesn't mean the site bought that vendor's bot product, and a standalone product such as DataDome isn't a reverse proxy, so it doesn't appear in that survey. Any precise adoption percentage you see for bot management is an estimate, not a measurement.

Is DataDome bigger than Akamai Bot Manager?

No public data answers that. Neither vendor publishes how many sites run its bot product. W3Techs counts Akamai's reverse proxy on 0.6% of all websites (W3Techs, October 2026), but it can't see whether Bot Manager is switched on, and DataDome isn't a reverse proxy, so it doesn't appear in that survey at all. What does differ is how they're bought: Akamai Bot Manager runs on Akamai's own edge platform, so it comes with an Akamai relationship, while DataDome is sold on its own and installed as a module on the server, CDN or framework a site already uses.

How do I tell which anti-bot vendor protects a specific site?

Check response headers and cookies before anything else. Cloudflare returns a cf-ray response header and sets a __cf_bm cookie when its bot products are on. DataDome sets a datadome cookie, loads its tag from js.datadome.co and serves challenges from captcha-delivery.com. Akamai sets _abck and bm_sz. HUMAN (formerly PerimeterX) sets _px-prefixed cookies such as _px3 and _pxvid. Imperva sets incap_ses or visid_incap. Kasada adds x-kpsdk request headers to protected calls. If headers are inconclusive, look at the challenge page itself and at which third-party script hosts the page loads.

---

Try JustBrowser

A multi-account browser for teams on a custom Chromium engine with native C++ integration — not an extension, not a wrapper. Each profile is its own browser with its own cookies, storage and proxy. 40+ identity parameters (canvas, WebGL, audio, fonts, screen, timezone, navigator, hardware) come from the engine rather than getting patched on top. Local REST API + CDP for Playwright, Puppeteer and Selenium. Windows x64 and macOS (Apple Silicon). $9.99/month or $99.99/year. 7-day free trial, card required — cancel any time in the seven days and you are not charged. Unlimited profiles.

Get started → · How it differs from Multilogin / GoLogin / AdsPower